Cross-device flow is when the user sits at a desktop and scans a QR code with the phone holding their wallet. Same-device flow is when they are already on the phone and a deep link opens the wallet. Both are OpenID4VP. Only the delivery differs.
Technical standardReviewed 7 October 2026
Between the wallet and the relying party, when the user shares data.
Issuer
Signs credentials: a member state, university, bank or employer
Issuance
EUDI Wallet
Belongs to the user, who decides what to share
Presentation
Relying party
The service that requests and checks the data
Trust layer: who is allowed to sign, and is it still valid?
Rules: the law and technical framework behind it all
Cross-device is the desktop case and needs a way for the result to reach the browser session that showed the QR, usually polling or a server-sent stream keyed to the session. Get this wrong and you get a page that never advances even though the wallet succeeded.
Same-device is simpler mechanically and harder in practice, because the user leaves your app for the wallet and has to come back. Return handling and session restoration are where these break.
A production integration needs both, picked by device detection, because people start signup on whatever is in front of them.
Defined in
OpenID4VP; ARF
If a wallet integration works in testing and falls over in production, this is usually why. Either the desktop session never hears back after the QR is scanned, or the user returns from the wallet app and lands in a session that no longer exists. Neither shows up when you test both halves on the same machine.
